How long is application information kept, and what privacy rights do I have? #
The current Privacy Notice uses different retention periods for different kinds of information.
Current operational periods #
- Incomplete drafts are scheduled for deletion after 30 days of inactivity.
- Sensitive submitted-application information and documents are scheduled for deletion 90 days after completion, unless a legal obligation, dispute or documented operational need requires another period.
- A restricted permanent register keeps minimum application, lifecycle and successful-registration information. It excludes addresses, documents, director identity details, payment proof and private notes.
- Relevant financial records follow a seven-year operational period from the latest relevant financial event, extended by any lawful hold.
- Non-financial notification and audit evidence generally follows a two-year operational period.
These are operating policies, not promises that override a legal obligation or lawful hold.
What rights may you exercise? #
Subject to POPIA and other applicable law, you may ask whether personal information is held, request access, ask for inaccurate or unlawfully held information to be corrected or deleted, object on applicable grounds, withdraw consent where consent is the basis, and complain to the Information Regulator.
Identity and authority may need to be verified before information is released or changed.
What happens after a security compromise? #
Where there are reasonable grounds to believe that personal information was accessed or acquired by an unauthorised person, POPIA requires notification to the Information Regulator and affected people as soon as reasonably possible, subject to limited lawful delay.
Report a concern through Start My Company Support or the privacy contact in the current Privacy Notice.
Related articles #
Last checked against the live Privacy Notice and POPIA: 31 August 2026
Leave a Reply